AddressSanitizer.cpp revision 19cd7e9ce28ed7f3326ebcd386eec215ab3763f9
1800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 3800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The LLVM Compiler Infrastructure 4800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 5800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is distributed under the University of Illinois Open Source 6800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// License. See LICENSE.TXT for details. 7800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 8800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 9800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 10800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is a part of AddressSanitizer, an address sanity checker. 11800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Details of the algorithm: 12800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 14800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 15800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 16800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#define DEBUG_TYPE "asan" 17800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 18d04a8d4b33ff316ca4cf961e06c9e312eff8e64fChandler Carruth#include "llvm/Transforms/Instrumentation.h" 19b5b86d263a651566cb25c0f406f75ceffb771029Kostya Serebryany#include "BlackList.h" 20800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/ArrayRef.h" 211c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov#include "llvm/ADT/DenseMap.h" 2259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov#include "llvm/ADT/DepthFirstIterator.h" 23800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/OwningPtr.h" 24800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallSet.h" 25800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallString.h" 26800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallVector.h" 27800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/StringExtras.h" 2806fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov#include "llvm/ADT/Triple.h" 291afbb517965e29b07cb42e2335d5eadd87de6535Alexey Samsonov#include "llvm/DIBuilder.h" 300b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/DataLayout.h" 310b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/Function.h" 320b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/IRBuilder.h" 330b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/InlineAsm.h" 340b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/IntrinsicInst.h" 350b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/LLVMContext.h" 360b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/Module.h" 370b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/Type.h" 3859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov#include "llvm/InstVisitor.h" 39800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/CommandLine.h" 40800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/DataTypes.h" 41800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/Debug.h" 42800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/raw_ostream.h" 43800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/system_error.h" 44800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Target/TargetMachine.h" 45800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/BasicBlockUtils.h" 461afbb517965e29b07cb42e2335d5eadd87de6535Alexey Samsonov#include "llvm/Transforms/Utils/Local.h" 47800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/ModuleUtils.h" 48800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <algorithm> 49d04a8d4b33ff316ca4cf961e06c9e312eff8e64fChandler Carruth#include <string> 50800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 51800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyusing namespace llvm; 52800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 53800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowScale = 3; 54800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 55800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 5619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovstatic const uint64_t kDefaultShadowOffsetPie = 0; 57800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 58800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const size_t kMaxStackMallocSize = 1 << 16; // 64K 59800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 60800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 61800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 62800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanModuleCtorName = "asan.module_ctor"; 637bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanModuleDtorName = "asan.module_dtor"; 647bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const int kAsanCtorAndCtorPriority = 1; 65800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanReportErrorTemplate = "__asan_report_"; 66800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanRegisterGlobalsName = "__asan_register_globals"; 677bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanUnregisterGlobalsName = "__asan_unregister_globals"; 689b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic const char *kAsanPoisonGlobalsName = "__asan_before_dynamic_init"; 699b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic const char *kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"; 70800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanInitName = "__asan_init"; 7195e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryanystatic const char *kAsanHandleNoReturnName = "__asan_handle_no_return"; 72800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingOffsetName = "__asan_mapping_offset"; 73800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingScaleName = "__asan_mapping_scale"; 74800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackMallocName = "__asan_stack_malloc"; 75800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackFreeName = "__asan_stack_free"; 7651c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryanystatic const char *kAsanGenPrefix = "__asan_gen_"; 77f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonovstatic const char *kAsanPoisonStackMemoryName = "__asan_poison_stack_memory"; 78f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonovstatic const char *kAsanUnpoisonStackMemoryName = 79f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov "__asan_unpoison_stack_memory"; 80800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 81800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackLeftRedzoneMagic = 0xf1; 82800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackMidRedzoneMagic = 0xf2; 83800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackRightRedzoneMagic = 0xf3; 84800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackPartialRedzoneMagic = 0xf4; 85800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 86c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// Accesses sizes are powers of two: 1, 2, 4, 8, 16. 87c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystatic const size_t kNumberOfAccessSizes = 5; 88c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 89800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Command-line flags. 90800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 91800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no-]asan-reads. 92800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 93800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument read instructions"), cl::Hidden, cl::init(true)); 94800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", 95800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument write instructions"), cl::Hidden, cl::init(true)); 96e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics", 97e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::desc("instrument atomic instructions (rmw, cmpxchg)"), 98e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::Hidden, cl::init(true)); 996e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryanystatic cl::opt<bool> ClAlwaysSlowPath("asan-always-slow-path", 1006e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany cl::desc("use instrumentation with slow path for all accesses"), 1016e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany cl::Hidden, cl::init(false)); 102c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// This flag limits the number of instructions to be instrumented 103324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// in any given BB. Normally, this should be set to unlimited (INT_MAX), 104324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 105324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// set it to 10000. 106324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryanystatic cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", 107324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::init(10000), 108324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::desc("maximal number of instructions to instrument in any given BB"), 109324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::Hidden); 110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-stack. 111800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClStack("asan-stack", 112800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle stack memory"), cl::Hidden, cl::init(true)); 113800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-use-after-return. 114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 115800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Check return-after-free"), cl::Hidden, cl::init(false)); 116800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-globals. 117800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClGlobals("asan-globals", 118800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle global objects"), cl::Hidden, cl::init(true)); 1199b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic cl::opt<bool> ClInitializers("asan-initialization-order", 1209b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false)); 121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClMemIntrin("asan-memintrin", 122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true)); 1236c55412ea4b39103a3a5764d49ddfdf50e066d56Kostya Serebryanystatic cl::opt<bool> ClRealignStack("asan-realign-stack", 1246c55412ea4b39103a3a5764d49ddfdf50e066d56Kostya Serebryany cl::desc("Realign stack to 32"), cl::Hidden, cl::init(true)); 125b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonovstatic cl::opt<std::string> ClBlacklistFile("asan-blacklist", 126b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov cl::desc("File containing the list of objects to ignore " 127800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "during instrumentation"), cl::Hidden); 128800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 129800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// These flags allow to change the shadow mapping. 130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The shadow mapping looks like 131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Shadow = (Mem >> scale) + (1 << offset_log) 132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingScale("asan-mapping-scale", 133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0)); 134800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingOffsetLog("asan-mapping-offset-log", 135800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1)); 136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 137800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Optimization flags. Not user visible, used mostly for testing 138800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// and benchmarking the tool. 139800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOpt("asan-opt", 140800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true)); 141800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", 142800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Instrument the same temp just once"), cl::Hidden, 143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(true)); 144800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptGlobals("asan-opt-globals", 145800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true)); 146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 147ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonovstatic cl::opt<bool> ClCheckLifetime("asan-check-lifetime", 148ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), 149ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov cl::Hidden, cl::init(false)); 150ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov 151800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Debug flags. 152800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 153800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(0)); 154800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 155800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(0)); 156800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClDebugFunc("asan-debug-func", 157800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::desc("Debug func")); 158800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 159800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 160800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 161800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 162800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 163800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanynamespace { 164ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany/// A set of dynamically initialized globals extracted from metadata. 165ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryanyclass SetOfDynamicallyInitializedGlobals { 166ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany public: 167ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany void Init(Module& M) { 168ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // Clang generates metadata identifying all dynamically initialized globals. 169ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany NamedMDNode *DynamicGlobals = 170ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany M.getNamedMetadata("llvm.asan.dynamically_initialized_globals"); 171ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany if (!DynamicGlobals) 172ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany return; 173ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany for (int i = 0, n = DynamicGlobals->getNumOperands(); i < n; ++i) { 174ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany MDNode *MDN = DynamicGlobals->getOperand(i); 175ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany assert(MDN->getNumOperands() == 1); 176ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany Value *VG = MDN->getOperand(0); 177ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // The optimizer may optimize away a global entirely, in which case we 178ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // cannot instrument access to it. 179ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany if (!VG) 180ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany continue; 181ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany DynInitGlobals.insert(cast<GlobalVariable>(VG)); 182ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany } 183ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany } 184ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany bool Contains(GlobalVariable *G) { return DynInitGlobals.count(G) != 0; } 185ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany private: 186ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany SmallSet<GlobalValue*, 32> DynInitGlobals; 187ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany}; 188ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany 18919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov/// This struct defines the shadow mapping using the rule: 19019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov/// shadow = (mem >> Scale) + Offset. 19119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovstruct ShadowMapping { 19219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov int Scale; 19319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov uint64_t Offset; 19419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov}; 19519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 19619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovstatic ShadowMapping getShadowMapping(const Module &M, int LongSize) { 19719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov llvm::Triple targetTriple(M.getTargetTriple()); 19819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov bool isAndroid = targetTriple.getEnvironment() == llvm::Triple::Android; 19919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 20019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 20119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 20219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Offset = isAndroid ? kDefaultShadowOffsetPie : 20319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov (LongSize == 32 ? kDefaultShadowOffset32 : kDefaultShadowOffset64); 20419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (ClMappingOffsetLog >= 0) { 20519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov // Zero offset log is the special case. 20619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Offset = (ClMappingOffsetLog == 0) ? 0 : 1ULL << ClMappingOffsetLog; 20719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 20819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 20919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Scale = kDefaultShadowScale; 21019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (ClMappingScale) { 21119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Scale = ClMappingScale; 21219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 21319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 21419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return Mapping; 215b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany} 216b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 21719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovstatic size_t RedzoneSizeForScale(int MappingScale) { 218b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany // Redzone used for stack and globals is at least 32 bytes. 219b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 22019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return std::max(32U, 1U << MappingScale); 221b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany} 222ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany 223800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany/// AddressSanitizer: instrument the code in module to find memory bugs. 224ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanystruct AddressSanitizer : public FunctionPass { 225ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov AddressSanitizer(bool CheckInitOrder = false, 226ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckUseAfterReturn = false, 227b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov bool CheckLifetime = false, 228b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov StringRef BlacklistFile = StringRef()) 229ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov : FunctionPass(ID), 230ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckInitOrder(CheckInitOrder || ClInitializers), 231ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckUseAfterReturn(CheckUseAfterReturn || ClUseAfterReturn), 232b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov CheckLifetime(CheckLifetime || ClCheckLifetime), 233b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov BlacklistFile(BlacklistFile.empty() ? ClBlacklistFile 234b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov : BlacklistFile) {} 2351416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany virtual const char *getPassName() const { 2361416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return "AddressSanitizerFunctionPass"; 2371416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany } 238ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentMop(Instruction *I); 239ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentAddress(Instruction *OrigIns, IRBuilder<> &IRB, 240800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, uint32_t TypeSize, bool IsWrite); 241c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 242c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, uint32_t TypeSize); 243ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 2442735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany bool IsWrite, size_t AccessSizeIndex); 245ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool instrumentMemIntrinsic(MemIntrinsic *MI); 246ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentMemIntrinsicParam(Instruction *OrigIns, Value *Addr, 247c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Size, 248800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore, bool IsWrite); 249800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 250ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool runOnFunction(Function &F); 2519b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany void createInitializerPoisonCalls(Module &M, 2529b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Value *FirstAddr, Value *LastAddr); 253a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany bool maybeInsertAsanInitAtFunctionEntry(Function &F); 25419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov void emitShadowMapping(Module &M, IRBuilder<> &IRB) const; 255ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany virtual bool doInitialization(Module &M); 256800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany static char ID; // Pass identification, replacement for typeid 257800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 258800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany private: 2598b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany void initializeCallbacks(Module &M); 260800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 2619b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany bool ShouldInstrumentGlobal(GlobalVariable *G); 2625a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany bool LooksLikeCodeInBug11395(Instruction *I); 2639b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany void FindDynamicInitializers(Module &M); 264800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 265ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder; 266ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckUseAfterReturn; 267ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckLifetime; 268800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LLVMContext *C; 2693574eca1b02600bac4e625297f4ecf745f4c4f32Micah Villmow DataLayout *TD; 270800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int LongSize; 271800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrTy; 27219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 273800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanCtorFunction; 274800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanInitFunction; 275ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Function *AsanHandleNoReturnFunc; 276b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov SmallString<64> BlacklistFile; 277b5b86d263a651566cb25c0f406f75ceffb771029Kostya Serebryany OwningPtr<BlackList> BL; 2789db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // This array is indexed by AccessIsWrite and log2(AccessSize). 2799db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany Function *AsanErrorCallback[2][kNumberOfAccessSizes]; 280f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany InlineAsm *EmptyAsm; 281ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals; 28259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 28359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov friend struct FunctionStackPoisoner; 284800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany}; 285c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 2861416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanyclass AddressSanitizerModule : public ModulePass { 287b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany public: 288b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov AddressSanitizerModule(bool CheckInitOrder = false, 289b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov StringRef BlacklistFile = StringRef()) 290ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov : ModulePass(ID), 291b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov CheckInitOrder(CheckInitOrder || ClInitializers), 292b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov BlacklistFile(BlacklistFile.empty() ? ClBlacklistFile 293b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov : BlacklistFile) {} 2941416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany bool runOnModule(Module &M); 2951416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany static char ID; // Pass identification, replacement for typeid 2961416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany virtual const char *getPassName() const { 2971416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return "AddressSanitizerModule"; 2981416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany } 299f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov 300b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany private: 3014684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov void initializeCallbacks(Module &M); 3024684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov 303b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany bool ShouldInstrumentGlobal(GlobalVariable *G); 304b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany void createInitializerPoisonCalls(Module &M, Value *FirstAddr, 305b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Value *LastAddr); 30619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t RedzoneSize() const { 30719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return RedzoneSizeForScale(Mapping.Scale); 30819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 309b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 310ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder; 311b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov SmallString<64> BlacklistFile; 312b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany OwningPtr<BlackList> BL; 313b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals; 314b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Type *IntptrTy; 315b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany LLVMContext *C; 3161416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany DataLayout *TD; 31719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 3184684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanPoisonGlobals; 3194684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanUnpoisonGlobals; 3204684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanRegisterGlobals; 3214684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanUnregisterGlobals; 322b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany}; 323b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 32459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// Stack poisoning does not play well with exception handling. 32559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// When an exception is thrown, we essentially bypass the code 32659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// that unpoisones the stack. This is why the run-time library has 32759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 32859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// stack in the interceptor. This however does not work inside the 32959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// actual function which catches the exception. Most likely because the 33059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// compiler hoists the load of the shadow value somewhere too high. 33159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// This causes asan to report a non-existing bug on 453.povray. 33259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// It sounds like an LLVM bug. 33359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovstruct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { 33459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Function &F; 33559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AddressSanitizer &ASan; 33659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov DIBuilder DIB; 33759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov LLVMContext *C; 33859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Type *IntptrTy; 33959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Type *IntptrPtrTy; 34019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 34159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 34259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov SmallVector<AllocaInst*, 16> AllocaVec; 34359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov SmallVector<Instruction*, 8> RetVec; 34459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t TotalStackSize; 34559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov unsigned StackAlignment; 34659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 34759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Function *AsanStackMallocFunc, *AsanStackFreeFunc; 34859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc; 34959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 3501c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Stores a place and arguments of poisoning/unpoisoning call for alloca. 3511c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov struct AllocaPoisonCall { 3521c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov IntrinsicInst *InsBefore; 3531c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov uint64_t Size; 3541c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool DoPoison; 3551c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov }; 3561c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov SmallVector<AllocaPoisonCall, 8> AllocaPoisonCallVec; 3571c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 3581c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Maps Value to an AllocaInst from which the Value is originated. 3591c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov typedef DenseMap<Value*, AllocaInst*> AllocaForValueMapTy; 3601c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValueMapTy AllocaForValue; 3611c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 36259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) 36359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov : F(F), ASan(ASan), DIB(*F.getParent()), C(ASan.C), 36459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IntptrTy(ASan.IntptrTy), IntptrPtrTy(PointerType::get(IntptrTy, 0)), 36519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping(ASan.Mapping), 36619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov TotalStackSize(0), StackAlignment(1 << Mapping.Scale) {} 36759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 36859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool runOnFunction() { 36959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (!ClStack) return false; 37059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // Collect alloca, ret, lifetime instructions etc. 37159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov for (df_iterator<BasicBlock*> DI = df_begin(&F.getEntryBlock()), 37259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov DE = df_end(&F.getEntryBlock()); DI != DE; ++DI) { 37359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov BasicBlock *BB = *DI; 37459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov visit(*BB); 37559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 37659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (AllocaVec.empty()) return false; 37759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 37859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov initializeCallbacks(*F.getParent()); 37959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 38059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov poisonStack(); 38159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 38259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (ClDebugStack) { 38359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov DEBUG(dbgs() << F); 38459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 38559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return true; 38659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 38759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 38859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // Finds all static Alloca instructions and puts 38959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // poisoned red zones around all of them. 39059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // Then unpoison everything back before the function returns. 39159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void poisonStack(); 39259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 39359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // ----------------------- Visitors. 39459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov /// \brief Collect all Ret instructions. 39559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void visitReturnInst(ReturnInst &RI) { 39659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov RetVec.push_back(&RI); 39759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 39859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 39959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov /// \brief Collect Alloca instructions we want (and can) handle. 40059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void visitAllocaInst(AllocaInst &AI) { 4011c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (!isInterestingAlloca(AI)) return; 40259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 40359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov StackAlignment = std::max(StackAlignment, AI.getAlignment()); 40459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AllocaVec.push_back(&AI); 40559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t AlignedSize = getAlignedAllocaSize(&AI); 40659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov TotalStackSize += AlignedSize; 40759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 40859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 4091c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov /// \brief Collect lifetime intrinsic calls to check for use-after-scope 4101c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov /// errors. 4111c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov void visitIntrinsicInst(IntrinsicInst &II) { 4121c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (!ASan.CheckLifetime) return; 4131c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Intrinsic::ID ID = II.getIntrinsicID(); 4141c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (ID != Intrinsic::lifetime_start && 4151c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov ID != Intrinsic::lifetime_end) 4161c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return; 4171c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Found lifetime intrinsic, add ASan instrumentation if necessary. 4181c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0)); 4191c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // If size argument is undefined, don't do anything. 4201c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (Size->isMinusOne()) return; 4211c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Check that size doesn't saturate uint64_t and can 4221c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // be stored in IntptrTy. 4231c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov const uint64_t SizeValue = Size->getValue().getLimitedValue(); 4241c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (SizeValue == ~0ULL || 4251c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) 4261c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return; 4271c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Find alloca instruction that corresponds to llvm.lifetime argument. 4281c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *AI = findAllocaForValue(II.getArgOperand(1)); 4291c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (!AI) return; 4301c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool DoPoison = (ID == Intrinsic::lifetime_end); 4311c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaPoisonCall APC = {&II, SizeValue, DoPoison}; 4321c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaPoisonCallVec.push_back(APC); 4331c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov } 4341c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 43559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // ---------------------- Helpers. 43659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void initializeCallbacks(Module &M); 43759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 4381c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Check if we want (and can) handle this alloca. 4391c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool isInterestingAlloca(AllocaInst &AI) { 4401c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return (!AI.isArrayAllocation() && 4411c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AI.isStaticAlloca() && 4421c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AI.getAllocatedType()->isSized()); 4431c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov } 4441c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 44519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t RedzoneSize() const { 44619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return RedzoneSizeForScale(Mapping.Scale); 44719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 44859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t getAllocaSizeInBytes(AllocaInst *AI) { 44959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Type *Ty = AI->getAllocatedType(); 45059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t SizeInBytes = ASan.TD->getTypeAllocSize(Ty); 45159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return SizeInBytes; 45259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 45359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t getAlignedSize(uint64_t SizeInBytes) { 45459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov size_t RZ = RedzoneSize(); 45559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return ((SizeInBytes + RZ - 1) / RZ) * RZ; 45659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 45759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t getAlignedAllocaSize(AllocaInst *AI) { 45859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 45959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return getAlignedSize(SizeInBytes); 46059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 4611c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov /// Finds alloca where the value comes from. 4621c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *findAllocaForValue(Value *V); 46359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void poisonRedZones(const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> IRB, 46459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Value *ShadowBase, bool DoPoison); 46559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> IRB, bool DoPoison); 46659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov}; 46759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 468800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} // namespace 469800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 470800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanychar AddressSanitizer::ID = 0; 471800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyINITIALIZE_PASS(AddressSanitizer, "asan", 472800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", 473800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany false, false) 474ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey SamsonovFunctionPass *llvm::createAddressSanitizerFunctionPass( 475b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov bool CheckInitOrder, bool CheckUseAfterReturn, bool CheckLifetime, 476b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov StringRef BlacklistFile) { 477ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov return new AddressSanitizer(CheckInitOrder, CheckUseAfterReturn, 478b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov CheckLifetime, BlacklistFile); 479800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 480800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 4811416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanychar AddressSanitizerModule::ID = 0; 4821416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya SerebryanyINITIALIZE_PASS(AddressSanitizerModule, "asan-module", 4831416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 4841416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany "ModulePass", false, false) 485b0dcf61252e58715a3bea79f4c112572df361c30Alexey SamsonovModulePass *llvm::createAddressSanitizerModulePass( 486b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov bool CheckInitOrder, StringRef BlacklistFile) { 487b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov return new AddressSanitizerModule(CheckInitOrder, BlacklistFile); 48825878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko} 48925878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko 4902735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryanystatic size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 4912735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany size_t Res = CountTrailingZeros_32(TypeSize / 8); 4922735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany assert(Res < kNumberOfAccessSizes); 4932735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany return Res; 4942735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany} 4952735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany 496800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Create a constant for Str so that we can pass it to the run-time lib. 497800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str) { 49818c7f80b3e83ab584bd8572695a3cde8bafd9d3cChris Lattner Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 499800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return new GlobalVariable(M, StrConst->getType(), true, 50051c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany GlobalValue::PrivateLinkage, StrConst, 50151c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany kAsanGenPrefix); 50251c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany} 50351c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany 50451c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryanystatic bool GlobalWasGeneratedByAsan(GlobalVariable *G) { 50551c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany return G->getName().find(kAsanGenPrefix) == 0; 506800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 507800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 508800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyValue *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 509800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Shadow >> scale 51019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); 51119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (Mapping.Offset == 0) 512800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Shadow; 513800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (Shadow >> scale) | offset 514800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, 51519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Offset)); 516800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 517800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 518c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanyvoid AddressSanitizer::instrumentMemIntrinsicParam( 519ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Instruction *OrigIns, 520800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, Value *Size, Instruction *InsertBefore, bool IsWrite) { 521800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the first byte. 522800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 523800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 524ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentAddress(OrigIns, IRB, Addr, 8, IsWrite); 525800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 526800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the last byte. 527800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 528800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 529800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *SizeMinusOne = IRB.CreateSub( 530800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Size, ConstantInt::get(Size->getType(), 1)); 531800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SizeMinusOne = IRB.CreateIntCast(SizeMinusOne, IntptrTy, false); 532800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 533800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrPlusSizeMinisOne = IRB.CreateAdd(AddrLong, SizeMinusOne); 534ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentAddress(OrigIns, IRB, AddrPlusSizeMinisOne, 8, IsWrite); 535800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 536800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 537800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 538800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Instrument memset/memmove/memcpy 539ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 540800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Dst = MI->getDest(); 541800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MemTransferInst *MemTran = dyn_cast<MemTransferInst>(MI); 5422735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany Value *Src = MemTran ? MemTran->getSource() : 0; 543800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Length = MI->getLength(); 544800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 545800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *ConstLength = dyn_cast<Constant>(Length); 546800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore = MI; 547800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength) { 548800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength->isNullValue()) return false; 549800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 550800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // The size is not a constant so it could be zero -- check at run-time. 551800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 552800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 553800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(Length, 55456139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany Constant::getNullValue(Length->getType())); 5554a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov InsertBefore = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 556800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 557800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 558ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsicParam(MI, Dst, Length, InsertBefore, true); 559800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Src) 560ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsicParam(MI, Src, Length, InsertBefore, false); 561800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 562800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 563800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 564e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// If I is an interesting memory access, return the PointerOperand 565e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// and set IsWrite. Otherwise return NULL. 566e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite) { 567800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 568e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentReads) return NULL; 569e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = false; 570800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return LI->getPointerOperand(); 571800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 572e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 573e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentWrites) return NULL; 574e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 575e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return SI->getPointerOperand(); 576e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 577e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 578e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 579e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 580e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return RMW->getPointerOperand(); 581e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 582e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 583e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 584e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 585e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return XCHG->getPointerOperand(); 586e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 587e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return NULL; 588800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 589800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 590ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanyvoid AddressSanitizer::instrumentMop(Instruction *I) { 5913780ad8b998d93d7db406919c06137cdb786ef05Axel Naumann bool IsWrite = false; 592e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany Value *Addr = isInterestingMemoryAccess(I, &IsWrite); 593e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany assert(Addr); 5949b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ClOpt && ClOptGlobals) { 5959b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (GlobalVariable *G = dyn_cast<GlobalVariable>(Addr)) { 5969b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If initialization order checking is disabled, a simple access to a 5979b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // dynamically initialized global is always valid. 598ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov if (!CheckInitOrder) 5999b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 6009b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If a global variable does not have dynamic initialization we don't 601407790604b8f71f7172bbdfb76c27e1799d241c2Kostya Serebryany // have to instrument it. However, if a global does not have initailizer 602407790604b8f71f7172bbdfb76c27e1799d241c2Kostya Serebryany // at all, we assume it has dynamic initializer (in other TU). 603407790604b8f71f7172bbdfb76c27e1799d241c2Kostya Serebryany if (G->hasInitializer() && !DynamicallyInitializedGlobals.Contains(G)) 6049b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 6059b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 606800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 6079b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 608800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigPtrTy = Addr->getType(); 609800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType(); 610800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 611800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(OrigTy->isSized()); 612800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize = TD->getTypeStoreSizeInBits(OrigTy); 613800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 614800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (TypeSize != 8 && TypeSize != 16 && 615800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TypeSize != 32 && TypeSize != 64 && TypeSize != 128) { 616800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore all unusual sizes. 617800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return; 618800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 619800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 620800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(I); 621ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentAddress(I, IRB, Addr, TypeSize, IsWrite); 622800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 623800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 62455cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// Validate the result of Module::getOrInsertFunction called for an interface 62555cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// function of AddressSanitizer. If the instrumented module defines a function 62655cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// with the same name, their prototypes must match, otherwise 62755cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// getOrInsertFunction returns a bitcast. 628b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryanystatic Function *checkInterfaceFunction(Constant *FuncOrBitcast) { 62955cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko if (isa<Function>(FuncOrBitcast)) return cast<Function>(FuncOrBitcast); 63055cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko FuncOrBitcast->dump(); 63155cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko report_fatal_error("trying to redefine an AddressSanitizer " 63255cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko "interface function"); 63355cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko} 63455cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko 635800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyInstruction *AddressSanitizer::generateCrashCode( 636ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *InsertBefore, Value *Addr, 6374f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany bool IsWrite, size_t AccessSizeIndex) { 638ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany IRBuilder<> IRB(InsertBefore); 639ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany CallInst *Call = IRB.CreateCall(AsanErrorCallback[IsWrite][AccessSizeIndex], 640ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Addr); 641f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We don't do Call->setDoesNotReturn() because the BB already has 642f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // UnreachableInst at the end. 643f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // This EmptyAsm is required to avoid callback merge. 644f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany IRB.CreateCall(EmptyAsm); 6453c7faae346f548c55cad86d82a2e242443001f23Kostya Serebryany return Call; 646800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 647800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6482735cf4aa52e31b8d2de90f836c3ad991215e04eKostya SerebryanyValue *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 649c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, 650c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany uint32_t TypeSize) { 65119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t Granularity = 1 << Mapping.Scale; 652c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // Addr & (Granularity - 1) 653c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *LastAccessedByte = IRB.CreateAnd( 654c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 655c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (Addr & (Granularity - 1)) + size - 1 656c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany if (TypeSize / 8 > 1) 657c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateAdd( 658c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 659c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 660c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateIntCast( 6616e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany LastAccessedByte, ShadowValue->getType(), false); 662c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 663c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 664c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany} 665c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 666ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanyvoid AddressSanitizer::instrumentAddress(Instruction *OrigIns, 667800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> &IRB, Value *Addr, 668800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize, bool IsWrite) { 669800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 670800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 671800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowTy = IntegerType::get( 67219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov *C, std::max(8U, TypeSize >> Mapping.Scale)); 673800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 674800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowPtr = memToShadow(AddrLong, IRB); 675800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *CmpVal = Constant::getNullValue(ShadowTy); 676800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowValue = IRB.CreateLoad( 677800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 678800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 679800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 68011c2a47af825a0f89d75aaa97ad873ed2acef266Kostya Serebryany size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 68119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t Granularity = 1 << Mapping.Scale; 682ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany TerminatorInst *CrashTerm = 0; 683ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany 6846e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 6854a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov TerminatorInst *CheckTerm = 6864a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 687ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany assert(dyn_cast<BranchInst>(CheckTerm)->isUnconditional()); 688f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BasicBlock *NextBB = CheckTerm->getSuccessor(0); 689c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany IRB.SetInsertPoint(CheckTerm); 690c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 691ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany BasicBlock *CrashBlock = 692ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 693ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany CrashTerm = new UnreachableInst(*C, CrashBlock); 694f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 695f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany ReplaceInstWithInst(CheckTerm, NewTerm); 696c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } else { 6974a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov CrashTerm = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), true); 698800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 699ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany 700ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *Crash = 701ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany generateCrashCode(CrashTerm, AddrLong, IsWrite, AccessSizeIndex); 702ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Crash->setDebugLoc(OrigIns->getDebugLoc()); 703800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 704800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7051416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanyvoid AddressSanitizerModule::createInitializerPoisonCalls( 706b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Module &M, Value *FirstAddr, Value *LastAddr) { 7079b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // We do all of our poisoning and unpoisoning within _GLOBAL__I_a. 7089b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Function *GlobalInit = M.getFunction("_GLOBAL__I_a"); 7099b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If that function is not present, this TU contains no globals, or they have 7109b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // all been optimized away 7119b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!GlobalInit) 7129b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 7139b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7149b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Set up the arguments to our poison/unpoison functions. 7159b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IRBuilder<> IRB(GlobalInit->begin()->getFirstInsertionPt()); 7169b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7179b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Add a call to poison all external globals before the given function starts. 7189b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IRB.CreateCall2(AsanPoisonGlobals, FirstAddr, LastAddr); 7199b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7209b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Add calls to unpoison all globals before each return instruction. 7219b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany for (Function::iterator I = GlobalInit->begin(), E = GlobalInit->end(); 7229b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany I != E; ++I) { 7239b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ReturnInst *RI = dyn_cast<ReturnInst>(I->getTerminator())) { 7249b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany CallInst::Create(AsanUnpoisonGlobals, "", RI); 7259b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7269b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7279b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany} 7289b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7291416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanybool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) { 7309b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Type *Ty = cast<PointerType>(G->getType())->getElementType(); 731324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 7329b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 73359a4a47a7bea7cc17877c6a3954ad9f8309ff1cbKostya Serebryany if (BL->isIn(*G)) return false; 7349b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!Ty->isSized()) return false; 7359b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!G->hasInitializer()) return false; 73651c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany if (GlobalWasGeneratedByAsan(G)) return false; // Our own global. 7379b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Touch only those globals that will not be defined in other modules. 7389b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Don't handle ODR type linkages since other modules may be built w/o asan. 7399b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->getLinkage() != GlobalVariable::ExternalLinkage && 7409b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany G->getLinkage() != GlobalVariable::PrivateLinkage && 7419b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany G->getLinkage() != GlobalVariable::InternalLinkage) 7429b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 7439b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Two problems with thread-locals: 7449b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // - The address of the main thread's copy can't be computed at link-time. 7459b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // - Need to poison all copies, not just the main thread's one. 7469b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->isThreadLocal()) 7479b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 7489b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // For now, just ignore this Alloca if the alignment is large. 749b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany if (G->getAlignment() > RedzoneSize()) return false; 7509b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7519b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Ignore all the globals with the names starting with "\01L_OBJC_". 7529b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Many of those are put into the .cstring section. The linker compresses 7539b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // that section by removing the spare \0s after the string terminator, so 7549b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // our redzones get broken. 7559b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if ((G->getName().find("\01L_OBJC_") == 0) || 7569b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany (G->getName().find("\01l_OBJC_") == 0)) { 7579b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring \\01L_OBJC_* global: " << *G); 7589b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 7599b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7609b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7619b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->hasSection()) { 7629b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany StringRef Section(G->getSection()); 7639b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Ignore the globals from the __OBJC section. The ObjC runtime assumes 7649b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 7659b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // them. 7669b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if ((Section.find("__OBJC,") == 0) || 7679b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany (Section.find("__DATA, __objc_") == 0)) { 7689b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G); 7699b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 7709b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7719b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 7729b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Constant CFString instances are compiled in the following way: 7739b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // -- the string buffer is emitted into 7749b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // __TEXT,__cstring,cstring_literals 7759b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // -- the constant NSConstantString structure referencing that buffer 7769b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // is placed into __DATA,__cfstring 7779b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Therefore there's no point in placing redzones into __DATA,__cfstring. 7789b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Moreover, it causes the linker to crash on OS X 10.7 7799b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (Section.find("__DATA,__cfstring") == 0) { 7809b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring CFString: " << *G); 7819b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 7829b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7839b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7849b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7859b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return true; 7869b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany} 7879b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7884684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonovvoid AddressSanitizerModule::initializeCallbacks(Module &M) { 7894684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov IRBuilder<> IRB(*C); 7904684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov // Declare our poisoning and unpoisoning functions. 7914684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanPoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction( 7924684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 7934684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanPoisonGlobals->setLinkage(Function::ExternalLinkage); 7944684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnpoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction( 7954684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanUnpoisonGlobalsName, IRB.getVoidTy(), NULL)); 7964684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage); 7974684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov // Declare functions that register/unregister globals. 7984684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanRegisterGlobals = checkInterfaceFunction(M.getOrInsertFunction( 7994684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanRegisterGlobalsName, IRB.getVoidTy(), 8004684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov IntptrTy, IntptrTy, NULL)); 8014684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 8024684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnregisterGlobals = checkInterfaceFunction(M.getOrInsertFunction( 8034684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanUnregisterGlobalsName, 8044684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 8054684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 8064684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov} 8074684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov 808800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This function replaces all global variables with new variables that have 809800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// trailing redzones. It also creates a function that poisons 810800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// redzones and inserts this function into llvm.global_ctors. 8111416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanybool AddressSanitizerModule::runOnModule(Module &M) { 8121416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany if (!ClGlobals) return false; 8131416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany TD = getAnalysisIfAvailable<DataLayout>(); 8141416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany if (!TD) 8151416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return false; 816b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov BL.reset(new BlackList(BlacklistFile)); 817d6f62c8da5aa4f3388cec1542309ffa623cac601Alexey Samsonov if (BL->isIn(M)) return false; 818b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany C = &(M.getContext()); 81919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov int LongSize = TD->getPointerSizeInBits(); 82019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov IntptrTy = Type::getIntNTy(*C, LongSize); 82119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping = getShadowMapping(M, LongSize); 8224684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov initializeCallbacks(M); 8234684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov DynamicallyInitializedGlobals.Init(M); 824b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 825800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<GlobalVariable *, 16> GlobalsToChange; 826800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8279b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany for (Module::GlobalListType::iterator G = M.global_begin(), 8289b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany E = M.global_end(); G != E; ++G) { 8299b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ShouldInstrumentGlobal(G)) 8309b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany GlobalsToChange.push_back(G); 831800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 832800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 833800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t n = GlobalsToChange.size(); 834800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (n == 0) return false; 835800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 836800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A global is described by a structure 837800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t beg; 838800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size; 839800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size_with_redzone; 840800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // const char *name; 8419b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // size_t has_dynamic_init; 842800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We initialize an array of such structures and pass it to a run-time call. 843800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *GlobalStructTy = StructType::get(IntptrTy, IntptrTy, 8449b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IntptrTy, IntptrTy, 8459b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IntptrTy, NULL); 8469b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany SmallVector<Constant *, 16> Initializers(n), DynamicInit; 847800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 848b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 849b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Function *CtorFunc = M.getFunction(kAsanModuleCtorName); 850b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert(CtorFunc); 851b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator()); 852800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8539b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // The addresses of the first and last dynamically initialized globals in 8549b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // this TU. Used in initialization order checking. 8559b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Value *FirstDynamic = 0, *LastDynamic = 0; 8569b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 857800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < n; i++) { 858800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *G = GlobalsToChange[i]; 859800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PointerType *PtrTy = cast<PointerType>(G->getType()); 860800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = PtrTy->getElementType(); 861208a4ff2b56f453910bb817540f34b8169f7702aKostya Serebryany uint64_t SizeInBytes = TD->getTypeAllocSize(Ty); 862b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t RZ = RedzoneSize(); 863b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t RightRedzoneSize = RZ + (RZ - (SizeInBytes % RZ)); 864800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 8659b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Determine whether this global should be poisoned in initialization. 866ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany bool GlobalHasDynamicInitializer = 867ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany DynamicallyInitializedGlobals.Contains(G); 86859a4a47a7bea7cc17877c6a3954ad9f8309ff1cbKostya Serebryany // Don't check initialization order if this global is blacklisted. 8697dadac65d375ff21b7a36bfb7642578d2f467525Kostya Serebryany GlobalHasDynamicInitializer &= !BL->isInInit(*G); 870800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 871800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *NewTy = StructType::get(Ty, RightRedZoneTy, NULL); 872800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *NewInitializer = ConstantStruct::get( 873800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewTy, G->getInitializer(), 874800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant::getNullValue(RightRedZoneTy), NULL); 875800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 876a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany SmallString<2048> DescriptionOfGlobal = G->getName(); 877a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += " ("; 878a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += M.getModuleIdentifier(); 879a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += ")"; 880a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany GlobalVariable *Name = createPrivateGlobalForString(M, DescriptionOfGlobal); 881800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 882800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Create a new global variable with enough space for a redzone. 883800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *NewGlobal = new GlobalVariable( 884800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, NewTy, G->isConstant(), G->getLinkage(), 885ce718ff9f42c7da092eaa01dd0242e8d5ba84713Hans Wennborg NewInitializer, "", G, G->getThreadLocalMode()); 886800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->copyAttributesFrom(G); 887b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany NewGlobal->setAlignment(RZ); 888800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 889800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Indices2[2]; 890800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[0] = IRB.getInt32(0); 891800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[1] = IRB.getInt32(0); 892800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 893800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->replaceAllUsesWith( 894f1639abf1aaba1448f719f595156cd0f4cd560ccKostya Serebryany ConstantExpr::getGetElementPtr(NewGlobal, Indices2, true)); 895800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->takeName(G); 896800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->eraseFromParent(); 897800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 898800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Initializers[i] = ConstantStruct::get( 899800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalStructTy, 900800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 901800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes), 902800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 903800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(Name, IntptrTy), 9049b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany ConstantInt::get(IntptrTy, GlobalHasDynamicInitializer), 905800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NULL); 9069b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 9079b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Populate the first and last globals declared in this TU. 908ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov if (CheckInitOrder && GlobalHasDynamicInitializer) { 9099b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany LastDynamic = ConstantExpr::getPointerCast(NewGlobal, IntptrTy); 9109b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (FirstDynamic == 0) 9119b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany FirstDynamic = LastDynamic; 9129b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 9139b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 914324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 915800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 916800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 917800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 918800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *AllGlobals = new GlobalVariable( 919800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, ArrayOfGlobalStructTy, false, GlobalVariable::PrivateLinkage, 920800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 921800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 9229b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Create calls for poisoning before initializers run and unpoisoning after. 923ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov if (CheckInitOrder && FirstDynamic && LastDynamic) 9249b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany createInitializerPoisonCalls(M, FirstDynamic, LastDynamic); 925800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall2(AsanRegisterGlobals, 926800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 927800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, n)); 928800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 9297bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // We also need to unregister globals at the end, e.g. when a shared library 9307bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // gets closed. 9317bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany Function *AsanDtorFunction = Function::Create( 9327bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 9337bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 9347bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 9357bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 9367bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB_Dtor.CreateCall2(AsanUnregisterGlobals, 9377bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 9387bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany ConstantInt::get(IntptrTy, n)); 9397bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndCtorPriority); 9407bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 941800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << M); 942800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 943800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 944800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 9458b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryanyvoid AddressSanitizer::initializeCallbacks(Module &M) { 9468b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRBuilder<> IRB(*C); 9479db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // Create __asan_report* callbacks. 9489db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 9499db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 9509db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany AccessSizeIndex++) { 9519db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // IsWrite and TypeSize are encoded in the function name. 9529db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany std::string FunctionName = std::string(kAsanReportErrorTemplate) + 9539db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany (AccessIsWrite ? "store" : "load") + itostr(1 << AccessSizeIndex); 9544f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // If we are merging crash callbacks, they have two parameters. 9557846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany AsanErrorCallback[AccessIsWrite][AccessSizeIndex] = 9567846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany checkInterfaceFunction(M.getOrInsertFunction( 9577846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany FunctionName, IRB.getVoidTy(), IntptrTy, NULL)); 9589db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 9599db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 960ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 961ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany AsanHandleNoReturnFunc = checkInterfaceFunction(M.getOrInsertFunction( 962ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany kAsanHandleNoReturnName, IRB.getVoidTy(), NULL)); 963f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We insert an empty inline asm after __asan_report* to avoid callback merge. 964f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 965f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany StringRef(""), StringRef(""), 966f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany /*hasSideEffects=*/true); 9678b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany} 9688b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 96919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovvoid AddressSanitizer::emitShadowMapping(Module &M, IRBuilder<> &IRB) const { 97019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov // Tell the values of mapping offset and scale to the run-time if they are 97119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov // specified by command-line flags. 97219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (ClMappingOffsetLog >= 0) { 97319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov GlobalValue *asan_mapping_offset = 97419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 97519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ConstantInt::get(IntptrTy, Mapping.Offset), 97619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov kAsanMappingOffsetName); 97719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov // Read the global, otherwise it may be optimized away. 97819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov IRB.CreateLoad(asan_mapping_offset, true); 97919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 98019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 98119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (ClMappingScale) { 98219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov GlobalValue *asan_mapping_scale = 98319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 98419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ConstantInt::get(IntptrTy, Mapping.Scale), 98519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov kAsanMappingScaleName); 98619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov // Read the global, otherwise it may be optimized away. 98719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov IRB.CreateLoad(asan_mapping_scale, true); 98819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 98919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov} 99019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 9918b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany// virtual 9928b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryanybool AddressSanitizer::doInitialization(Module &M) { 9938b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany // Initialize the private fields. No one has accessed them before. 9948b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany TD = getAnalysisIfAvailable<DataLayout>(); 9958b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 9968b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany if (!TD) 9978b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany return false; 998b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov BL.reset(new BlackList(BlacklistFile)); 9998b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany DynamicallyInitializedGlobals.Init(M); 10008b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 10018b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany C = &(M.getContext()); 10028b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany LongSize = TD->getPointerSizeInBits(); 10038b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IntptrTy = Type::getIntNTy(*C, LongSize); 10048b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 10058b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanCtorFunction = Function::Create( 10068b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 10078b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleCtorName, &M); 10088b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction); 10098b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany // call __asan_init in the module ctor. 10108b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRBuilder<> IRB(ReturnInst::Create(*C, AsanCtorBB)); 10118b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanInitFunction = checkInterfaceFunction( 10128b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), NULL)); 10138b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanInitFunction->setLinkage(Function::ExternalLinkage); 10148b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRB.CreateCall(AsanInitFunction); 10159db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany 101619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping = getShadowMapping(M, LongSize); 101719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov emitShadowMapping(M, IRB); 1018800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 10197bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndCtorPriority); 1020ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany return true; 1021ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany} 1022ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 1023a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryanybool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 1024a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // For each NSObject descendant having a +load method, this method is invoked 1025a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // by the ObjC runtime before any of the static constructors is called. 1026a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // Therefore we need to instrument such methods with a call to __asan_init 1027a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // at the beginning in order to initialize our runtime before any access to 1028a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // the shadow memory. 1029a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // We cannot just ignore these methods, because they may call other 1030a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // instrumented functions. 1031a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany if (F.getName().find(" load]") != std::string::npos) { 1032a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRBuilder<> IRB(F.begin()->begin()); 1033a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRB.CreateCall(AsanInitFunction); 1034a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return true; 1035a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany } 1036a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return false; 1037a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany} 1038a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 1039ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::runOnFunction(Function &F) { 1040800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (BL->isIn(F)) return false; 1041800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (&F == AsanCtorFunction) return false; 1042324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 10438b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany initializeCallbacks(*F.getParent()); 1044a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 1045a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // If needed, insert __asan_init before checking for AddressSafety attr. 1046a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany maybeInsertAsanInitAtFunctionEntry(F); 1047a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 1048831737d329a727f53a1fb0572f7b7a8127208881Bill Wendling if (!F.getAttributes().hasAttribute(AttributeSet::FunctionIndex, 1049831737d329a727f53a1fb0572f7b7a8127208881Bill Wendling Attribute::AddressSafety)) 10506765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling return false; 1051800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1052800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) 1053800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 10546765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling 10556765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling // We want to instrument every address only once per basic block (unless there 10566765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling // are calls between uses). 1057800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallSet<Value*, 16> TempsToInstrument; 1058800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 16> ToInstrument; 105995e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany SmallVector<Instruction*, 8> NoReturnCalls; 1060e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany bool IsWrite; 1061800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1062800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Fill the set of memory operations to instrument. 1063800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 1064800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 1065800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 1066324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany int NumInsnsPerBB = 0; 1067800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = FI->begin(), BE = FI->end(); 1068800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 1069bcb55ce3862bbbedac4e09d7099c9e0efc434e4bKostya Serebryany if (LooksLikeCodeInBug11395(BI)) return false; 1070e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (Value *Addr = isInterestingMemoryAccess(BI, &IsWrite)) { 1071800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptSameTemp) { 1072800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TempsToInstrument.insert(Addr)) 1073800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; // We've seen this temp in the current BB. 1074800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1075800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (isa<MemIntrinsic>(BI) && ClMemIntrin) { 1076800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // ok, take it. 1077800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 107895e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany if (CallInst *CI = dyn_cast<CallInst>(BI)) { 1079800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A call inside BB. 1080800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 1081a17babb021aa9dc3441ecce1ac8a62d2b27edecbKostya Serebryany if (CI->doesNotReturn()) { 108295e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany NoReturnCalls.push_back(CI); 108395e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 1084800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1085800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 1086800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1087800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ToInstrument.push_back(BI); 1088324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany NumInsnsPerBB++; 1089324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) 1090324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany break; 1091800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1092800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1093800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1094800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Instrument. 1095800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int NumInstrumented = 0; 1096800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = ToInstrument.size(); i != n; i++) { 1097800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Inst = ToInstrument[i]; 1098800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugMin < 0 || ClDebugMax < 0 || 1099800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 1100e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (isInterestingMemoryAccess(Inst, &IsWrite)) 1101ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMop(Inst); 1102800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany else 1103ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 1104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1105800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NumInstrumented++; 1106800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1107800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 110859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov FunctionStackPoisoner FSP(F, *this); 110959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool ChangedStack = FSP.runOnFunction(); 111095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 111195e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 111295e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 111395e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany for (size_t i = 0, n = NoReturnCalls.size(); i != n; i++) { 111495e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany Instruction *CI = NoReturnCalls[i]; 111595e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany IRBuilder<> IRB(CI); 1116ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany IRB.CreateCall(AsanHandleNoReturnFunc); 111795e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 1118324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "ASAN done instrumenting:\n" << F << "\n"); 111995e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 112095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany return NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 1121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1123800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic uint64_t ValueForPoison(uint64_t PoisonByte, size_t ShadowRedzoneSize) { 1124800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 1) return PoisonByte; 1125800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 2) return (PoisonByte << 8) + PoisonByte; 1126800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 4) 1127800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return (PoisonByte << 24) + (PoisonByte << 16) + 1128800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (PoisonByte << 8) + (PoisonByte); 1129858143816d43e58b17bfd11cb1b57afbd7f0f893Craig Topper llvm_unreachable("ShadowRedzoneSize is either 1, 2 or 4"); 1130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic void PoisonShadowPartialRightRedzone(uint8_t *Shadow, 1133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Size, 1134b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t RZSize, 1135800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowGranularity, 1136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint8_t Magic) { 1137b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany for (size_t i = 0; i < RZSize; 1138800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany i+= ShadowGranularity, Shadow++) { 1139800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (i + ShadowGranularity <= Size) { 1140800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = 0; // fully addressable 1141800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (i >= Size) { 1142800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Magic; // unaddressable 1143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 1144800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Size - i; // first Size-i bytes are addressable 1145800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1147800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1148800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 114959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// Workaround for bug 11395: we don't want to instrument stack in functions 115059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// with large assembly blobs (32-bit only), otherwise reg alloc may crash. 115159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// FIXME: remove once the bug 11395 is fixed. 115259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovbool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 115359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (LongSize != 32) return false; 115459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov CallInst *CI = dyn_cast<CallInst>(I); 115559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (!CI || !CI->isInlineAsm()) return false; 115659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (CI->getNumArgOperands() <= 5) return false; 115759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // We have inline assembly with quite a few arguments. 115859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return true; 115959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov} 116059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 116159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::initializeCallbacks(Module &M) { 116259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IRBuilder<> IRB(*C); 116359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AsanStackMallocFunc = checkInterfaceFunction(M.getOrInsertFunction( 116459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov kAsanStackMallocName, IntptrTy, IntptrTy, IntptrTy, NULL)); 116559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AsanStackFreeFunc = checkInterfaceFunction(M.getOrInsertFunction( 116659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov kAsanStackFreeName, IRB.getVoidTy(), 116759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IntptrTy, IntptrTy, IntptrTy, NULL)); 116859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AsanPoisonStackMemoryFunc = checkInterfaceFunction(M.getOrInsertFunction( 116959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 117059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AsanUnpoisonStackMemoryFunc = checkInterfaceFunction(M.getOrInsertFunction( 117159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 117259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov} 117359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 117459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::poisonRedZones( 117559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> IRB, Value *ShadowBase, 117659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool DoPoison) { 117719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t ShadowRZSize = RedzoneSize() >> Mapping.Scale; 1178800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowRZSize >= 1 && ShadowRZSize <= 4); 1179800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZTy = Type::getIntNTy(*C, ShadowRZSize * 8); 1180800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZPtrTy = PointerType::get(RZTy, 0); 1181800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1182800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonLeft = ConstantInt::get(RZTy, 1183800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackLeftRedzoneMagic : 0LL, ShadowRZSize)); 1184800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonMid = ConstantInt::get(RZTy, 1185800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackMidRedzoneMagic : 0LL, ShadowRZSize)); 1186800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonRight = ConstantInt::get(RZTy, 1187800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackRightRedzoneMagic : 0LL, ShadowRZSize)); 1188800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1189800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison the first red zone. 1190800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PoisonLeft, IRB.CreateIntToPtr(ShadowBase, RZPtrTy)); 1191800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1192800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison all other red zones. 1193b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t Pos = RedzoneSize(); 1194800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1195800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1196800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1197800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1198b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert(AlignedSize - SizeInBytes < RedzoneSize()); 1199800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Ptr = NULL; 1200800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1201800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize; 1202800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1203800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowBase->getType() == IntptrTy); 1204800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (SizeInBytes < AlignedSize) { 1205800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the partial redzone at right 1206800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd( 1207800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ShadowBase, ConstantInt::get(IntptrTy, 120819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov (Pos >> Mapping.Scale) - ShadowRZSize)); 1209b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t AddressableBytes = RedzoneSize() - (AlignedSize - SizeInBytes); 1210800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t Poison = 0; 1211800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoPoison) { 1212800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonShadowPartialRightRedzone((uint8_t*)&Poison, AddressableBytes, 1213b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany RedzoneSize(), 121419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 1ULL << Mapping.Scale, 1215800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackPartialRedzoneMagic); 1216800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1217800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PartialPoison = ConstantInt::get(RZTy, Poison); 1218800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PartialPoison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 1219800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1220800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1221800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the full redzone at right. 1222800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd(ShadowBase, 122319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ConstantInt::get(IntptrTy, Pos >> Mapping.Scale)); 12241c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool LastAlloca = (i == AllocaVec.size() - 1); 12251c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Value *Poison = LastAlloca ? PoisonRight : PoisonMid; 1226800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 1227800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1228b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Pos += RedzoneSize(); 1229800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1230800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1231800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 123259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::poisonStack() { 123359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t LocalStackSize = TotalStackSize + 123459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov (AllocaVec.size() + 1) * RedzoneSize(); 1235800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 123659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool DoStackMalloc = ASan.CheckUseAfterReturn 1237800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany && LocalStackSize <= kMaxStackMallocSize; 1238800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 12391c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov assert(AllocaVec.size() > 0); 1240800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsBefore = AllocaVec[0]; 1241800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsBefore); 1242800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1243800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1244800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ByteArrayTy = ArrayType::get(IRB.getInt8Ty(), LocalStackSize); 1245800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *MyAlloca = 1246800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new AllocaInst(ByteArrayTy, "MyAlloca", InsBefore); 124759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (ClRealignStack && StackAlignment < RedzoneSize()) 124859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov StackAlignment = RedzoneSize(); 124959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov MyAlloca->setAlignment(StackAlignment); 1250800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(MyAlloca->isStaticAlloca()); 1251800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *OrigStackBase = IRB.CreatePointerCast(MyAlloca, IntptrTy); 1252800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *LocalStackBase = OrigStackBase; 1253800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1254800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1255800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LocalStackBase = IRB.CreateCall2(AsanStackMallocFunc, 1256800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), OrigStackBase); 1257800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1258800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1259800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This string will be parsed by the run-time (DescribeStackAddress). 1260800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallString<2048> StackDescriptionStorage; 1261800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany raw_svector_ostream StackDescription(StackDescriptionStorage); 1262800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << F.getName() << " " << AllocaVec.size() << " "; 1263800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 12641c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Insert poison calls for lifetime intrinsics for alloca. 12651c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool HavePoisonedAllocas = false; 12661c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov for (size_t i = 0, n = AllocaPoisonCallVec.size(); i < n; i++) { 12671c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov const AllocaPoisonCall &APC = AllocaPoisonCallVec[i]; 12681c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov IntrinsicInst *II = APC.InsBefore; 12691c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *AI = findAllocaForValue(II->getArgOperand(1)); 12701c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov assert(AI); 12711c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov IRBuilder<> IRB(II); 12721c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov poisonAlloca(AI, APC.Size, IRB, APC.DoPoison); 12731c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov HavePoisonedAllocas |= APC.DoPoison; 12741c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov } 12751c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 1276b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t Pos = RedzoneSize(); 1277800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Replace Alloca instructions with base+offset. 1278800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1279800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1280800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1281800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Name = AI->getName(); 1282800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << Pos << " " << SizeInBytes << " " 1283800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany << Name.size() << " " << Name << " "; 1284800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1285b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert((AlignedSize % RedzoneSize()) == 0); 1286f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov Value *NewAllocaPtr = IRB.CreateIntToPtr( 1287800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Pos)), 1288f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov AI->getType()); 12891afbb517965e29b07cb42e2335d5eadd87de6535Alexey Samsonov replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB); 1290f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov AI->replaceAllUsesWith(NewAllocaPtr); 1291b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Pos += AlignedSize + RedzoneSize(); 1292800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1293800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(Pos == LocalStackSize); 1294800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1295800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Write the Magic value and the frame description constant to the redzone. 1296800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 1297800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 1298800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1299800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus1 = IRB.CreateAdd(LocalStackBase, 130059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov ConstantInt::get(IntptrTy, 130159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov ASan.LongSize/8)); 1302800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus1 = IRB.CreateIntToPtr(BasePlus1, IntptrPtrTy); 13039ce84c1c95c0153a2f33e188ce0db00770425f9eAlexey Samsonov GlobalVariable *StackDescriptionGlobal = 1304a5f54f14435d881b10d8eb65e19fa42af95757e9Kostya Serebryany createPrivateGlobalForString(*F.getParent(), StackDescription.str()); 130559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, 130659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IntptrTy); 1307800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Description, BasePlus1); 1308800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1309800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the stack redzones at the entry. 131059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); 131159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov poisonRedZones(AllocaVec, IRB, ShadowBase, true); 1312800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1313800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack before all ret instructions. 1314800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = RetVec.size(); i < n; i++) { 1315800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Ret = RetVec[i]; 1316800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRBRet(Ret); 1317800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Mark the current frame as retired. 1318800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 1319800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1320800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack. 132159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov poisonRedZones(AllocaVec, IRBRet, ShadowBase, false); 1322800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1323f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // In use-after-return mode, mark the whole stack frame unaddressable. 1324800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateCall3(AsanStackFreeFunc, LocalStackBase, 1325800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), 1326800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany OrigStackBase); 1327f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov } else if (HavePoisonedAllocas) { 1328f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // If we poisoned some allocas in llvm.lifetime analysis, 1329f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // unpoison whole stack frame now. 1330f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov assert(LocalStackBase == OrigStackBase); 1331f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov poisonAlloca(LocalStackBase, LocalStackSize, IRBRet, false); 1332800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1333800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1334800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1335bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany // We are done. Remove the old unused alloca instructions. 1336bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) 1337bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany AllocaVec[i]->eraseFromParent(); 1338800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1339f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov 134059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, 134159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IRBuilder<> IRB, bool DoPoison) { 1342f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // For now just insert the call to ASan runtime. 1343f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); 1344f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov Value *SizeArg = ConstantInt::get(IntptrTy, Size); 1345f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov IRB.CreateCall2(DoPoison ? AsanPoisonStackMemoryFunc 1346f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov : AsanUnpoisonStackMemoryFunc, 1347f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov AddrArg, SizeArg); 1348f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov} 134959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 135059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// Handling llvm.lifetime intrinsics for a given %alloca: 135159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. 135259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// (2) if %size is constant, poison memory for llvm.lifetime.end (to detect 135359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// invalid accesses) and unpoison it for llvm.lifetime.start (the memory 135459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// could be poisoned by previous llvm.lifetime.end instruction, as the 135559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// variable may go in and out of scope several times, e.g. in loops). 135659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// (3) if we poisoned at least one %alloca in a function, 135759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// unpoison the whole stack frame at function exit. 135859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 13591c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey SamsonovAllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) { 13601c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) 13611c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // We're intested only in allocas we can handle. 13621c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return isInterestingAlloca(*AI) ? AI : 0; 13631c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // See if we've already calculated (or started to calculate) alloca for a 13641c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // given value. 13651c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValueMapTy::iterator I = AllocaForValue.find(V); 13661c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (I != AllocaForValue.end()) 13671c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return I->second; 13681c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Store 0 while we're calculating alloca for value V to avoid 13691c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // infinite recursion if the value references itself. 13701c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValue[V] = 0; 13711c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *Res = 0; 13721c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (CastInst *CI = dyn_cast<CastInst>(V)) 13731c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Res = findAllocaForValue(CI->getOperand(0)); 13741c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov else if (PHINode *PN = dyn_cast<PHINode>(V)) { 13751c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) { 13761c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Value *IncValue = PN->getIncomingValue(i); 13771c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Allow self-referencing phi-nodes. 13781c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (IncValue == PN) continue; 13791c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *IncValueAI = findAllocaForValue(IncValue); 13801c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // AI for incoming values should exist and should all be equal. 13811c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (IncValueAI == 0 || (Res != 0 && IncValueAI != Res)) 13821c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return 0; 13831c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Res = IncValueAI; 138459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 138559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 13861c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (Res != 0) 13871c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValue[V] = Res; 138859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return Res; 138959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov} 1390